Vol. VI
DevSecOps Forensics & Incident Response
Evidence architecture, investigation playbooks and AI-agent forensics
§ 01, Do que trata
Evidence architecture first, then investigation playbooks for pipelines, supply chain, infrastructure and identity, then forensics for AI agents. The incident timeline on the series page is the spine of the playbooks.
§ 02, O que quero que o leitor consiga fazer
- 01
Design a delivery system so that an investigation has evidence to work with.
- 02
Run a structured investigation of a pipeline, supply-chain, infrastructure or identity incident.
- 03
Reconstruct an AI agent’s actions from its session record and say whether it was manipulated.
§ 03, O diagrama ao qual eu sempre volto
Rola para o lado →
§ 04, Estrutura planejada
- Parte I
Evidence architecture
What to log in a delivery system, where to keep it so that it stays unaltered, and how to document chain of custody.
- Parte II
Investigation playbooks: pipeline and supply chain
Structured investigations of a compromised pipeline or a malicious dependency: detection, timeline, preservation.
- Parte III
Investigation playbooks: infrastructure and identity
Container escape, abused cloud credentials, lateral movement and privilege escalation, with the acquisition steps for each.
- Parte IV
AI agent forensics
Recording agent sessions, the log schema for tool calls, and reconstructing an incident from raw logs.
- Parte V
Forensics readiness and governance
Assessing how ready a delivery organisation is to investigate, legal hold, and fitting readiness into an existing DevSecOps programme.
§ 05, Quando der para ler